document
The manifest in a repository names artifacts; the manifest the mesh holds
names digests. Keeping them the same file would mean a repository
carrying a digest — wrong the moment anybody edits anything, and pinning
a value nobody could have checked.
So a resource says `"artifact": "server"`, and resolving a build rewrites
it to the image reference or the archive's source and digest, removing
the build-time word entirely. The host has never heard of an artifact and
its strict decoder would refuse one, at the worst moment.
A module that builds nothing is ordinary and needs no build section —
most of what a person installs is configuration, and a field that exists
to be left blank is a field nobody fills in correctly.
Refusals worth having:
- an artifact declared and not produced blames THE BUILD, not the
resource. Both are failures and the remedies are in different places;
telling somebody to fix the wrong one costs an afternoon. Found by
injection: the first version's message could not be told apart from
the resource-level one, so the check was not actually tested.
- a build reads its own repository and nothing else. An input path
leaving it makes what gets built depend on whatever happens to be on
the machine building it.
- two artifacts with one name, because a resource naming it could mean
either.
